1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Bug#19695101 UPGRADE YASSL TO 2.3.5

Browse Source
This commit is contained in:
Kristofer Pettersson 2014-09-29 10:17:38 +02:00
parent 68ea0ea13b
commit d6d45fa3d8
3 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
extra/yassl/README
View File

@ -12,6 +12,15 @@ before calling SSL_new();
*** end Note *** *** end Note ***
yaSSL Release notes, version 2.3.5 (9/29/2014)
This release of yaSSL fixes an RSA Padding check vulnerability reported by
Intel Security Advanced Threat Research team
See normal build instructions below under 1.0.6.
See libcurl build instructions below under 1.3.0 and note in 1.5.8.
yaSSL Release notes, version 2.3.4 (8/15/2014) yaSSL Release notes, version 2.3.4 (8/15/2014)
This release of yaSSL adds checking to the input_buffer class itself. This release of yaSSL adds checking to the input_buffer class itself.

2
extra/yassl/include/openssl/ssl.h
View File

@ -35,7 +35,7 @@
#include "rsa.h" #include "rsa.h"
#define YASSL_VERSION "2.3.4" #define YASSL_VERSION "2.3.5"
#if defined(__cplusplus) #if defined(__cplusplus)

2
extra/yassl/taocrypt/src/rsa.cpp
View File

@ -177,7 +177,7 @@ word32 RSA_BlockType1::UnPad(const byte* pkcsBlock, word32 pkcsBlockLen,
// skip past the padding until we find the separator // skip past the padding until we find the separator
unsigned i=1; unsigned i=1;
while (i<pkcsBlockLen && pkcsBlock[i++]) { // null body while (i<pkcsBlockLen && pkcsBlock[i++] == 0xFF) { // null body
} }
if (!(i==pkcsBlockLen || pkcsBlock[i-1]==0)) if (!(i==pkcsBlockLen || pkcsBlock[i-1]==0))
return 0; return 0;